Skip to content

foomuuri

This section can usually be omitted, since the default values should be fine.

This section defines common options for Foomuuri. If you do need to change something, it is usually better to override a single value rather than the whole section. Example:

foomuuri {
  # Change rpfilter's value, keep everything else at the default
  rpfilter no
}

log_rate

log_rate (default: "1/second burst 3") is the default logging rate per source IP address. By default, the first three entries per source IP address are logged, followed by one additional entry per second. The rate specification follows the same format as in a rate limit rule.

log_input, log_output, log_forward, log_rpfilter, log_invalid, log_smurfs

These options define the default logging behavior for specific events:

  • log_input (default: yes)
  • log_output (default: yes)
  • log_forward (default: yes)
  • log_rpfilter (default: yes)
  • log_invalid (default: no)
  • log_smurfs (default: no)

The value for each can be:

  • yes, to log it at log_rate
  • no, to disable logging for it
  • "3/second burst 10", to log it at a specific rate

log_prefix

log_prefix (default: "$(szone)-$(dzone) $(statement)") defines the default log prefix for logging. Some built-in chains, such as rpfilter and invalid, always use a static log prefix.

log_level

log_level (default: "level info flags skuid") is the syslog level for logging. For possible values, see the rule-specific version.

localhost_zone

localhost_zone (default: localhost) is the name of the zone used for the computer running Foomuuri, similar to "localhost" in hostnames. See the zone and zone-zone sections for more information.

dbus_zone

dbus_zone (default: public) is the name of your outgoing internet zone. It is used for D-Bus support.

rpfilter

rpfilter (default: yes) enables or disables reverse path filtering. The value can be:

  • yes, to enable it on all interfaces
  • no, to disable it
  • eth0 eth1 eth2, to enable it on the specified interfaces
  • -eth1 -eth2, to enable it on all interfaces except eth1 and eth2

flowtable

flowtable (default: no) enables the Netfilter flowtable infrastructure for the specified interfaces, for example flowtable eth0 eth1. It improves forwarding performance on high-speed interfaces. The value yes, or negative notation, is not supported here, and at least two interfaces must be specified.

The optional hw_offload=yes keyword enables hardware offloading (make sure your interface supports hw-tc-offload).

The optional counter=yes keyword enables conntrack accounting support in the flowtable fast path. Note that this is not enabled by default in the Linux kernel; use sysctl -w net.netfilter.nf_conntrack_acct=1 to enable it.

counter

counter (default: no) adds an anonymous byte and packet counter to all rules. The value can be:

  • yes, to add it to all rules
  • no, to not add it
  • localhost-public public-localhost, to add it only to rules in the localhost-public and public-localhost sections
  • public-any, to add it to all public-* sections
  • any-public, to add it to all *-public sections

permanent_counter

If permanent_counter (default: no) is enabled (value: yes), named counter values are preserved across foomuuri reload. After a reboot, they are restored to the values saved during the previous foomuuri start or foomuuri reload.

set_size

set_size (default: 65535) is the size of the rate limit set, the log rate limit set, and the dynamic iplist set - that is, the maximum number of entries in the kernel set. The default value of 65535 is fine for a normal host; for a corporate firewall, a larger value is recommended, for example 262143 (2^18 - 1). Setting this value too high does no harm. If a set is full, new entries cannot be added; this doesn't matter for log rate limits, but for rate limits and dynamic iplists it means the statement (usually accept for a rate limit, drop for an iplist) is skipped. See foomuuri ruleset list for the contents of your currently active sets.

recursion_limit

recursion_limit (default: 10000) is the internal limit used to avoid macro and template expansion loops. Increase this value if you get a false "Possible macro or template loop" error.

priority_offset

priority_offset (default: 5) is the chain priority offset for rules generated by Foomuuri. Tune this value if you have multiple software adding chains and want to control their processing order. For example, iptables uses offset 0 and firewalld uses 10; the lowest priority is processed first. So, to process Foomuuri's rules first, use -5; to process them last, use 20.

dbus_firewalld

dbus_firewalld (default: no) enables or disables firewalld D-Bus emulation inside Foomuuri. NetworkManager can instruct firewalld to attach and detach interfaces to zones via a D-Bus call. This option enables Foomuuri to listen for the same firewalld D-Bus calls and act on them.

nft_bin

nft_bin (default: nft) is the name of the nft binary. A full path can be specified if required.

try_reload_timeout

try_reload_timeout (default: 15) is the timeout, in seconds, for the foomuuri try-reload command.